Attackers Are Scanning Exposed Vite Dev Servers to Steal AWS and Azure Keys
A month-long campaign hunted cloud credentials on internet-facing Vite servers using a file-read bypass disclosed in April.
Key points
- F5 honeypots logged more than 800 attacks and around 32,000 raw events over a month against internet-exposed Vite development servers.
- The attackers exploit CVE-2026-39364, a file-read bypass affecting Vite 7.1.0 through 7.3.2 and 8.x before 8.0.5, disclosed on April 7.
- Scans hunted for AWS credential files, Azure tokens, .env files and Linux system files like /etc/passwd.
- Most traffic came from Google Cloud IPs in the United States and Belgium.
- F5 tells administrators to patch Vite, block port 5173 and rotate any secrets a vulnerable server could reach.
Someone's combing the internet for exposed Vite servers and using them as a shortcut into other people's cloud accounts.
Vite is a popular tool developers run on their own machines to build websites. It normally listens only to the local computer. But developers often open it to the wider internet, sometimes on purpose, sometimes by accident through a Docker setting.
That's the door the attackers are walking through.
What flaw are the attackers using?
They're exploiting CVE-2026-39364, a high-severity bug in Vite that lets an unauthenticated stranger read files they shouldn't be able to see. Disclosed on April 7, it affects Vite versions 7.1.0 through 7.3.2 and the 8.x line before 8.0.5.
The trick is simple. By tacking parameters like ?raw, ?import&raw or ?import&url&inline onto a normal web request, the server drops its filter and hands the file back in plain text with a 200 response. No password, no login.
The attackers also try double-encoded path tricks to slip past reverse proxies and web application firewalls, the middle layers that are supposed to spot dodgy URLs.
What are they stealing?
Cloud keys, mostly. F5's honeypot sensors, decoy systems set up to attract and record attacks, watched the scanners run through long wordlists aimed at files developers most often leave lying around.
Targets included environment files (.env, .env.production, .env.local), AWS credential and configuration files, Azure access tokens, Terraform state files and /etc/passwd. Any one of those can hand an attacker the keys to a company's cloud bill or its production infrastructure. This pattern of targeting developer tooling to reach cloud credentials isn't new; our July story on a flaw in Amazon's AI coding assistant shows the same method spreading across different tools.
F5, first reported by BleepingComputer, recorded more than 800 attacks and roughly 32,000 raw events over the month it watched.
Where is the traffic coming from?
Most of it came from Google Cloud IP ranges in the United States and Belgium. Using a mainstream cloud provider gives the scans a clean-looking origin that's harder to block outright without collateral damage.
The busiest addresses were 34.14.15.105, 34.16.200.129 and 34.11.196.206. F5 recommends blocklisting them. Those same IPs have also been slinging exploits for older Vite bugs: CVE-2025-30208, CVE-2025-31125 (already flagged as actively exploited) and CVE-2024-45811.
| Detail | Value |
|---|---|
| Vulnerability | CVE-2026-39364 |
| Disclosed | 7 April |
| Affected versions | Vite 7.1.0-7.3.2, 8.x before 8.0.5 |
| Attacks observed | 800+ over one month |
| Raw events | ~32,000 |
| Default Vite port | 5173 |
What should developers do now?
Update Vite to a patched release. Block inbound traffic to port 5173 at the network edge. Drop suspicious requests that touch the /@fs/ path. Don't trust User-Agent strings from crawlers as a filter; they're trivial to fake.
If your Vite server was reachable from the public internet while unpatched, treat every secret it could read as burned. Rotate the AWS keys, the Azure tokens, the API keys. All of them.
The uncomfortable read here: a dev tool that was never meant to face the internet has become a reliable path to production cloud accounts, because the defaults are safe but the shortcuts aren't. Expect more of this, not less.
